ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c
Size

88KB
Sample

221207-c1p5jagc73
MD5

26439550d99f4469e72e4ed8413cedca
SHA1

507310521ec544bff6f8170c991435defbc0f4d9
SHA256

ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c
SHA512

82cfb8c63b9fba78edf76ed10f09fdd58ff4fdd1fcc2a26b0bced97642e618705cdc5226a2159cbfc29bb8f7810bb65cf0eb48fb82ac5fbd218d4327102ae634
SSDEEP

1536:nX4Mr/Ea1gQ9mMjDDUFVG/op/nooolonrooIon8rNw+o2veupwKlVBCMrY+U:op8jDDUFVGeooolonrooIonGo2veupjW

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c
- Size
  
  88KB
- MD5
  
  26439550d99f4469e72e4ed8413cedca
- SHA1
  
  507310521ec544bff6f8170c991435defbc0f4d9
- SHA256
  
  ddca9cc2a9a23672814f632660f6ee92b0a371b99c60259ea6989776f5510f6c
- SHA512
  
  82cfb8c63b9fba78edf76ed10f09fdd58ff4fdd1fcc2a26b0bced97642e618705cdc5226a2159cbfc29bb8f7810bb65cf0eb48fb82ac5fbd218d4327102ae634
- SSDEEP
  
  1536:nX4Mr/Ea1gQ9mMjDDUFVG/op/nooolonrooIon8rNw+o2veupwKlVBCMrY+U:op8jDDUFVGeooolonrooIonGo2veupjW
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence